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Description 



METHODS AND SYSTEMS FOR AUTOMATED ANALYSIS OF SIGNALING 



LINK UTILIZATION 



5 



Technical Field 



The present invention relates to methods and systems for analyzing 
signaling link utilization. More particularly, the present invention relates to 
methods and systems for automated analysis of signaling link utilization. 



In telecommunications networks, signaling links carry signaling messages 
between signaling nodes. In modern telecommunications networks, the signaling 
links are separate from the media trunks used to carry media communications 
between end users. The signaling messages that traverse the signaling links 

15 include messages used to set up and tear down calls, database queries and 
responses, and network management messages. 

Due to the vital function performed by signaling links in 
telecommunications networks, it is desirable to ensure that signaling links are 
available at all times to send and receive signaling message traffic. For example, 

20 a DS0 link is capable of carrying data at 56 kilobits per second. 56 kilobits per 
second translates into 7,000 bytes per second. In order to ensure that a 
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signaling link does not become congested, networks are typically engineered 
such that signaling links are 40% loaded. Using the DSO link as an example, this 
means that a DSO link is typically engineered to carry 40% of 7000 or 2800 bytes 
per second. Assuming an average message size of 40 bytes, a DSO signaling 
5 link engineered for 40% capacity can carry 70 messages per second. 

While engineering signaling links for 40% or other capacity is a good 
practice, sudden bursts of signaling messages or network management 
messages may cause a link to become congested and temporarily unavailable to 
carry signaling message traffic. Since such a situation is undesirable, service 

10 providers use network monitoring systems to analyze signaling link utilization and 
determine causes of over-utilization of signaling links. 

One problem with conventional network monitoring systems is that 
analyzing signaling link utilization requires a user to identify a signaling link that 
has become congested and to manually search through signaling message data 

15 to determine the cause of the signaling link congestion. For example, link 
utilization applications typically display link utilization information for a plurality of 
different signaling links on a single display screen. In order to diagnose a 
signaling link utilization problem, a user must manually identify the signaling link 
that caused the problem and the time period over which the problem occurred 

20 from the link utilization application. The user must then terminate the link 
utilization application and execute a protocol analysis application. Using the 
protocol analysis application, the user must input the parameters associated with 
the signaling link of interest and the time period and extract the corresponding 



Atty. Docket No.: 1322/158 

-3- 

messages from a signaling message database. Such a manual link utilization 
diagnosis process is labor-intensive and subject to user errors. 

Accordingly, there exists a need for improved methods and systems for 
automated analysis of signaling link utilization. 

5 

Disclosure of Invention 
The present invention includes methods and systems for automated 
analysis of signaling link utilization. According to one exemplary method, 
signaling messages are copied from a plurality of different signaling links and 

10 stored in a database. Link utilization data is derived from the data in the 
database and displayed to a user in graphical format via a computer display 
device. The user analyzes the graphical data and selects, using a user input 
device, a portion of the link utilization data that the user desires to analyze. 
Based on the portion of the link utilization data selected by the user, signaling 

15 message data corresponding to the selected portion is automatically extracted 
from the message database. In one implementation, the user can launch a 
protocol analysis application from a link utilization screen simply by clicking on 
the link utilization data of interest using a mouse. The signaling message data is 
then displayed to the user. The user can use the signaling message data to 

20 determine the cause of the signaling link utilization problem. Thus, signaling link 
utilization and protocol analysis functions are combined. Because the signaling 
message data corresponding to the point selected by the user in the link 
utilization data is automatically extracted from the database and displayed to the 
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user, the time required for analyzing link utilization problems is greatly reduced 
over conventional manual methods. 

Accordingly, it is an object of the invention to provide methods and 
systems for automated analysis of signaling link utilization. 
5 It is another object of the invention to provide a convenient graphical user 

interface for a user to automatically analyze signaling link utilization data. 

It is yet another object of the invention to combine signaling link utilization 
functions with protocol analysis functions in a network monitoring system. 

10 Brief Description of the Drawings 

Preferred embodiments of the invention will now be described with 
reference to the accompanying drawings of which: 

Figure 1 is a block diagram of a network monitoring system including an 
automated signaling link utilization analyzer according to an embodiment of the 
1 5 present invention; 

Figure 2 is a flow chart illustrating exemplary steps for performing 
automated signaling link utilization analysis according to an embodiment of the 
present invention; 

Figure 3 is a computer screen shot of signaling link utilization data that 
20 may be displayed to a user by an automated signaling link utilization analyzer 
according to an embodiment of the present invention; 
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Figure 4 is a computer screen shot illustrating exemplary message data 
that may be displayed to a user based on selected signaling link utilization data 
selected by the user according to an embodiment of the present invention; and 

Figure 5 is a block diagram illustrating an alternate implementation of a 
5 network monitoring system including an automated signaling link utilization 
analyzer according to an embodiment of the present invention. 

Detailed Description of the Invention 
Figure 1 is a block diagram illustrating a network monitoring system 

10 including an automated signaling link utilization analyzer according to an 
embodiment of the present invention. Referring to Figure 1, the network 
monitoring system may include components internal to a signaling message 
routing node, such as STP 100, and external components 102, 104, and 106 that 
process and analyze signaling messages copied from STP 100. 

15 In the illustrated example, the internal components include message copy 

functions 108 located on link interface modules 110 and a network monitoring 
transport card 112. Message copy functions 108 copy signaling messages sent 
and received over external signaling links. Network monitoring transport card 
112 transports messages copied by message copy functions 108 to external 

20 network monitoring processors 102. 

In addition to network monitoring components, STP 100 includes message 
routing functions 114 resident on link interface modules 110 and database 
service functions 116 resident on a database services module 118. Message 
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routing functions 114 route or transfer signaling messages between signaling 
links. For example, message routing functions 114 may implement MTP level 3 
routing for SS7 signaling messages or IP routing for IP signaling messages. 
Database service functions 116 may perform database-related services for 
5 received signaling messages, such as global title translation and number 
portability lookups. 

From a hardware perspective, each of the modules in STP 100 may 
include a printed circuit board including an application processor and a 
communications processor mounted thereon. The applications processor may 

10 perform signaling message processing functions, such as routing and message 
copying. The communications processor may control communications between 
processing modules over a pair of counter rotating, dual ring buses 120. 

The external components of the network monitoring system illustrated in 
Figure 1 include network monitoring processors 102, network monitoring server 

15 104, and user terminal 106. Network monitoring processors 102 receive 
signaling messages copied by message copy functions 108 and store the 
signaling messages in a signaling message database 122. Network monitoring 
processors 102 may be connected to network monitoring server 104 by any 
suitable type of network, such as a service provider's internal IP network 124. 

20 Similarly, user interface 106 may be connected to network monitoring server 104 
by a public or private IP network 126. In one example, network monitoring server 
104 may include a web server, user terminal 106 may include a web client, and 
network 126 may be the public Internet. 
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The signaling messages for multiple signaling links may be intermixed in 
database 122, making analysis using manual methods difficult. In order to avoid 
this difficulty, network monitoring server 104 includes a link utilization application 
128, an automated link utilization analyzer 130, and a user interface 132. Link 
5 utilization application 128 analyzes signaling link utilization based on messages 
stored in database 122 and displays the signaling link utilization to a user in a 
convenient format, such as a graphical format. The graphical format may include 
link utilization data for many different signaling links. The user may select a 
portion of the graph that corresponds to a spike or instance of comparatively high 

10 link utilization. Automated link utilization analyzer 130 automatically extracts 
signaling message data from signaling message database 122 corresponding to 
the selected link utilization data and displays the signaling message data for the 
user. In one implementation, automated link utilization analyzer 130 may include 
a protocol analysis application that can be launched from a link utilization screen 

15 displayed by link utilization application 128 in response to the selection by the 
user. User interface 132 displays the signaling message data to the user via a 
convenient interface, such as web browser. Because the user can automatically 
launch a protocol analysis application from a link utilization screen and view the 
signaling messages that cause link utilization problems, the time required to 

20 diagnose utilization problems is decreased over that of conventional manual 
methods. 

Figure 2 is a flow chart illustrating exemplary steps for automated 
signaling link utilization analysis according to an embodiment of the present 
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invention. Referring to Figure 2, in step 200, signaling messages are copied 
from signaling links and stored in a database. In Figure 1, this function is 
performed by message copy functions 108. In one exemplary implementation, 
message copy functions 108 broadcast network monitoring service request via 
5 UDP to network monitoring processors 102. Each network monitoring processor 
102 may be preconfigured to service a particular message copy function 108 or 
group of message copy functions 108. Accordingly, the network monitoring 
processor provisioned to service a particular message copy function 108 
responds to the broadcast service request with a service acceptance. A TCP/IP 

10 connection is then established between the message copy function 108 and one 
of the network monitoring processors 102 via network monitoring transport card 
112. Copied messages are then sent over the TCP/IP connection and stored in 
signaling message database 112. 

In step 202, link utilization data is generated for different signaling links. 

15 This function may be performed by link utilization application 128 on network 
monitoring server 104 based on messages stored in database 122. For 
example, link utilization application 128 may count the number of signaling 
messages received per unit time for each signaling link being monitored. The 
signaling link may be identified by one or more parameters in the signaling 

20 message, such as the originating point code (OPC), destination point code (DPC) 
and circuit identifier code (CIC), or by a link identifier that a message copy 
function 108 associates with the signaling message. 
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ln one exemplary implementation, message copy functions 108 may 
encapsulate each copied signaling message in a network monitoring packet that 
indicates the type and origin of a particular message. One type of packet that 
may be used is a link data packet. A link data packet includes a header that 
5 identifies the card and port on which a particular message was received. The 
card and port identifiers in the link data message may be used by link utilization 
analyzer 128 to count messages that traverse a particular signaling link. 
Exemplary network monitoring packet formats suitable for use with embodiments 
of the present invention are described in commonly assigned, co-pending U.S. 

10 patent application number 10/154,309, filed May 23, 2002, the disclosure of 
which is incorporated herein by reference in its entirety. 

In step 204, signaling link utilization data is displayed to a user. The 
signaling link utilization data may be displayed to the user in any convenient 
format, such as graphical format or tabular format. Figure 3 illustrates an 

15 example of signaling link utilization data that is displayed to a user in graphical 
format. In Figure 3, the ordinate axis represents time and the abscissa axis 
represents link occupancy per unit time. Each color represented in the graph 
represents utilization of a different signaling link. As illustrated in Figure 3, 
signaling data for a plurality of different signaling links may be displayed to the 

20 user. However, using conventional network monitoring systems, the user will be 
required to manually extract signaling message data for link occupancy data of 
interest to the user. Using a conventional network monitoring system, this step 
would be performed by the user identifying data of interest from the link utilization 
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graph, manually identifying the signaling link, manually launching a protocol 
analysis application, and manually inputting parameters to extract data for the 
link of interest. Such a process is time consuming and error prone. 

The present invention automates signaling link utilization analysis by 
5 allowing the user to automatically launch a protocol analysis application from the 
link utilization screen. In one implementation, the user is allowed to select link 
occupancy data from the display of link occupancy data and automatically 
receive the corresponding signaling message data. Accordingly, in step 204, 
input from the user is received regarding a portion of the link utilization data 

10 desired to be analyzed. In the example illustrated in Figure 3, the user may 
select spike 300 using a user input device, such as a keyboard or mouse, 
because spike 300 includes the highest point of link occupancy data in the graph. 
In step 208, signaling message data corresponding to the selected link 
occupancy or utilization data is extracted from message database 122. In order 

15 to extract the correct information, automated link utilization analyzer 130 may 
identify the data that the user selected. This step may be performed by selecting 
the point on the graph closest to the point on which the user clicked. Once the 
point is identified, the corresponding signaling link and time period are identified. 
The signaling link and time period may then be used as a filter for filtering 

20 signaling messages in database 122. 

Returning to Figure 2, in step 210, the signaling messages data is 
displayed to the user. Figure 4 illustrates an example of signaling message data 
that may be displayed to the user. In Figure 4, the signaling message data 
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includes the date on which a signaling message was sent, the time, the sending 
node, the link ID, the type of signaling message, the count, the length, and other 
information regarding the signaling message. Using this information, the user 
can diagnose the cause of signaling link utilization problems. For example, if all 
5 signaling messages on an over-utilized link are from a short message service 
center, the spike in signaling link utilization may be caused by spam SMS 
messages. In another example, if all of the signaling messages are directed to 
an 800 number database for determining the directory number corresponding to 
an 800 number for a radio station, a radio station call-in contest may be 

10 determined to be the cause of the signaling link over-utilization. By displaying 
the signaling messages corresponding to the signaling link utilization data in a 
convenient format, the present invention greatly reduces the time required to 
diagnose signaling link utilization problems over the time required using 
conventional network monitoring systems. 

15 The present invention is not limited to displaying the signaling message 

data illustrated in Figure 4. Any suitable data that may be extracted from or 
derived from signaling messages on a particular signaling link is intended to be 
within the scope of the invention. For example, automated signaling link 
utilization analyzer 126 may display the TCAP, MAP, or other application level 

20 message type so that the application that caused the link utilization problem can 
be identified. In addition, for IP telephony signaling messages, automated 
signaling link utilization analyzer 130 may display the signaling message type for 
similar diagnostic purposes. 
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Although in the embodiment illustrated in Figure 1 the automated signaling 
link utilization analyzer 130 was used with a network monitoring system that was 
partially implemented using components within a network routing node, the 
present invention is not limited to such an embodiment. Figure 5 illustrates an 
5 alternate implementation of a network monitoring system with which automated 
signaling link utilization analysis of the present invention may be used. Referring 
to Figure 5, a network monitoring system includes network monitoring shelves 
500 and signaling link probes 502 for copying signaling messages on access 
links between service switching points 504 and signaling transfer points 506. 

10 Network monitoring shelves may include link interface modules for copying the 
signaling messages and link interface cards for processing the signaling 
messages. Examples of network monitoring shelves 500 include the i2000 and 
i3000 shelves available from Tekelec of Calabasas, California. 

The network monitoring system also includes site collectors 508 for 

15 received signaling messages copied from the signaling links and storing the 
signaling messages copies in signaling message database 122. Site collectors 
508 may be implemented using a general purpose computing platform, such as a 
netrawork station available from SUN Microsystems. 

Network monitoring server 104 may include the same components as the 

20 corresponding network monitoring server illustrated in Figure 1. These 
components include link utilization application 128, automated signaling link 
utilization analyzer 130, and user interface 132. A description of these 
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components is provided above with regard to Figure 1 and is not repeated 
herein. 

In operation, network monitoring shelves 500 copy signaling messages 
received on the access signaling links. Site collectors 508 receive the signaling 
5 message copies and store the signaling messages in databases 122. Link 
utilization application 124 accesses the messages in databases 122 and displays 
link utilization data, similar to that illustrated in Figure 3. The end user, using a 
user input device, selects some of the link utilization data for which further 
analysis is desired. Automated signaling link utilization analyzer 130 determines 

10 the link utilization data selected by the user, formulates parameters for filtering 
messages stored in database 122, filters the appropriate messages and displays 
the messages to the user. The user can then diagnose the cause of signaling 
link utilization problems. 

Thus, as described herein, the present invention includes methods and 

15 systems for automated signaling link utilization analysis. Rather than requiring 
the user to separately analyze link utilization and signaling message data, the 
present invention automates this process by linking signaling link utilization data 
with signaling message data in an automated manner. Because this data can be 
linked and displayed to the user in a convenient format, the time required for 

20 diagnosing signaling link utilization problems is reduced. 

It will be understood that various details of the invention may be changed 
without departing from the scope of the invention. Furthermore, the foregoing 
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description is for the purpose of illustration only, and not for the purpose of 
limitation— the invention being defined by the claims. 



